CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32942
https://notcve.org/view.php?id=CVE-2021-32942
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location. La vulnerabilidad podría exponer credenciales en texto sin cifrar de AVEVA InTouch Runtime 2020 R2 y todas las versiones anteriores (WindowViewer) si un usuario autorizado privilegiado crea un volcado de memoria de diagnóstico del proceso y lo guarda en una ubicación no protegida • https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03 https://www.aveva.com/en/support/cyber-security-updates • CWE-312: Cleartext Storage of Sensitive Information CWE-316: Cleartext Storage of Sensitive Information in Memory •
CVSS: 9.8EPSS: 3%CPEs: 5EXPL: 0CVE-2018-10628
https://notcve.org/view.php?id=CVE-2018-10628
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process. AVEVA InTouch 2014 R2 SP1 y anteriores, InTouch 2017, InTouch 2017 Update 1 e InTouch 2017 Update 2 permiten que un usuario no autenticado envíe un paquete especialmente manipulado que podría sobrescribir el búfer en un locale que no emplea un separador de punto flotante. Su explotación podría permitir la ejecución remota de código bajo los privilegios del proceso InTouch View. • http://www.securityfocus.com/bid/104864 https://ics-cert.us-cert.gov/advisories/ICSA-18-200-02 https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec127%28003%29.pdf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2018-10620
https://notcve.org/view.php?id=CVE-2018-10620
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. En AVEVA InduSoft Web Studio v8.1 y v8.1SP1 e InTouch Machine Edition v2017 8.1 y v2017 8.1 SP1, un usuario remoto podría enviar un paquete cuidadosamente manipulado para explotar una vulnerabilidad de desbordamiento de búfer basado en pila durante acciones relacionadas con etiquetas, alarmas o eventos, tales como la lectura y la escritura, con la posibilidad de que se ejecute código. • http://www.securityfocus.com/bid/104870 https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01 https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf https://www.tenable.com/security/research/tra-2018-19 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •